Win32.HLLW.Autoruner1.23598

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Dump.exe' = 'C:\Drivers\Dump.exe'

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf

Malicious functions:

Executes the following:

<SYSTEM32>\attrib.exe -s -h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h T:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h U:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h V:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Q:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h S:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h R:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h W:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h C:\Drivers\Dump.exe
<SYSTEM32>\find.exe /I "naxo" C:\autorun.inf
<SYSTEM32>\attrib.exe +h +s C:\autorun.inf
<SYSTEM32>\attrib.exe +h +s E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s E:\autorun.inf
<SYSTEM32>\attrib.exe -h -s C:\autorun.inf
<SYSTEM32>\attrib.exe +s +h C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Y:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h X:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Y:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +h +s C:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h Z:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h P:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h E:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h F:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h G:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h G:\Drivers\Dump.exe
<SYSTEM32>\msg.exe * hacked by -={ naxo itc }=-
<SYSTEM32>\attrib.exe +s +h "%TEMP%\tmpfile0.bat"
<SYSTEM32>\cmd.exe /c ""%TEMP%\tmpfile0.bat" "
<SYSTEM32>\reg.exe add hklm\software\microsoft\windows\currentversion\run /V Dump.exe /D C:\Drivers\Dump.exe /f
<SYSTEM32>\attrib.exe +h +s E:\Drivers
<SYSTEM32>\attrib.exe +h +s C:\Drivers
<SYSTEM32>\ping.exe -n 5 127.0.0.1
<SYSTEM32>\attrib.exe +s +h H:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h M:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h N:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h O:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h N:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h I:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h I:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h J:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h L:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe +s +h K:\Drivers\Dump.exe
<SYSTEM32>\attrib.exe -s -h K:\Drivers\Dump.exe

Modifies file system :

Creates the following files:

C:\autorun.inf
%TEMP%\tmpfile0.bat

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\autorun.inf
C:\autorun.inf
%TEMP%\tmpfile0.bat

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information